Privacy Policy

Last updated: July 25, 2023.

Introduction

We are a site for biologists, computational researchers, and others (collectively, “Visitors” or “you”) to explore curated single-cell transcriptomics datasets at cellxgene.cziscience.com (the “Site”). As a visitor to the Site, the collection, use and sharing of your personal data is subject to this Privacy Policy.

Please read our full Terms of Use ("Terms") (which incorporates this Privacy Policy) and this Privacy Policy for complete details, but here is the key information you should know:

• This is a free service we provide in order to advance biomedical research.
• The datasets made available through the Site are not personally identifiable.
• We use the privacy-friendly Plausible service to collect basic analytics about our Site traffic (e.g. the number of visitors and page views) so we know how it’s being used. We also analyze the usage of the Site which helps us improve the Site as well as get a sense of its impact.

Data Controllers and Contracting Parties

By accessing and using the Site, you are contracting with the Chan Zuckerberg Initiative Foundation, a 501(c)(3) nonprofit private foundation (“Provider,” “we” or “us”), and agreeing that Provider is the “controller” of your personal data provided to, collected by, or processed in connection with the Site. This Privacy Policy along with the Terms of Use form a contract. If you don’t agree with this Privacy Policy or the Terms of Use, do not access or use the Site. This Privacy Policy applies to only this Site, and excludes any other services that state that they are offered under a different privacy policy. For example, this Privacy Policy does not apply to chanzuckerberg.com.

Data We Collect

Cellxgene is a tool that enables fast visualizations of curated single-cell transcriptomics datasets. It takes data submitted by researchers (gene expression matrices that indicate counts of how often genes are expressed in certain cell types and metadata detailing how those matrices were generated) and helps you visualize it for faster analysis, exploration, and – hopefully – insight.

The datasets available on the Site are not personally identifiable.

• Data You Provide To Us.

  We collect certain information from you which may include identifiers or professional or employment-related information. This includes data you provide us as part of a submission or registering for an account (ex: name and email address). This information is necessary in order to create your account and provide you with access to the services we offer on the Site. We collect your information if you decide to sign up for our newsletter, if you contact us for support or with information about a dataset via email, or if you respond to a survey or participate in a feedback session. We also collect the data you submit for display in CELLxGENE (ex: single-cell .h5ad matrix files).

• Data From Your Browser or Device.

  Whenever you use any online service, certain internet or other electronic network activity information gets created and logged automatically; the same is true when you access or use the Site. Here’s what we collect:

  • Log.

    When you access or use the Site (whether on your computer or on a mobile device), we gather certain information automatically and store it in log files. This information includes IP addresses, the Internet Site Provider, referring pages, date/time stamps, clickstream data, and duration of time spent on the Site. We collect this data pursuant to our legitimate interests in understanding how Visitors use our Site, improving our Site, and securing our Site.

  • Device.

    In addition to log data, we collect information about the device you’re using to access the Site; this includes the type of device, browser type, and operating system that helps us understand when something goes wrong. We collect this data pursuant to our legitimate interests in improving our Site.

  • Cookies and Other Similar Technologies.

    For certain users that need to log into CELLxGENE Discover to publish data, we use essential cookies (small text files sent by your computer each time you access the Site that are unique to your account or your browser) to enable that use. We also use local storage to save your preferences (e.g., to remember that you blocked a pop-up). For web analytics, we do not use Google Analytics. Instead, we use the privacy-friendly Plausible as our website analytic tool. Learn more about Plausible’s data and privacy practices here.

• Other Sources.

  We may display publicly available information about you when you mention us on social media networks, such as Twitter. This is reflected in the “CELL X GENE IN THE NEWS” section on the Site.

• Sensitive Personal Information.

  We do not collect sensitive personal information about you, and thus we do not use or disclose your sensitive personal information.

How We Use Your Data

CZIF does not sell your personal information nor do we share your personal data for behavioral advertising purposes. We do use your data for the following business purposes:

• Site.

  We use the information we collect to provide, maintain, secure, and improve the Site, including understanding the content that Visitors find valuable.

• Communications.

  We may also use your information to respond to an email from you, send a survey, engage about a dataset you wish to share, or send our newsletter if you opt-in to receiving it. Survey responses and feedback sessions help us understand and improve the Site.

• Aggregate Insights and Analytics.

  We use the privacy-friendly Plausible service to produce and share aggregated insights that do not identify you. For example we may receive from Plausible statistics about the location of our Visitors, and how many Visitors engage with the Site on a monthly basis. These aggregated insights are not personally identifiable. We also use your information to analyze how our Site is being used, such as understanding how many downloads there have been for a specific dataset.

• Other Sources.

  We use information from Other Sources to understand what you find valuable, what we can improve, and what impact our Site is having on the science community.

• Security and Investigations.

  We use your data (including your communications) if we think it’s necessary for security purposes or to investigate violations of our Terms of Use or this Privacy Policy.

Retention and Deletion

We retain your personal data as long as we believe we need it for the purposes we have collected it or to meet legal obligations, resolve disputes, maintain security, prevent fraud and abuse, or enforce our agreements with you. This includes data you provided to us and data generated or inferred from your use of the Site.

How We Disclose Information

Except in the instances listed below, we will not disclose your personal information to others unless you consent to it, nor will we ever sell your personal information to advertisers or other third parties. However, we disclose your information in the following ways:

• Third Party Site Providers.

  CZIF works with service providers that help us operate, secure, and improve the Site. These services are, for example, performing statistical analysis, database management services, database hosting, survey providers, and security. To the extent they will have access to your information, their use is limited by this Privacy Policy.

• Legal and Safety Reasons.

  We may disclose information if we believe in good faith that it’s necessary (a) in connection with any legal investigation; (b) to comply with relevant laws or to respond to subpoenas or warrants served on us; (c) to protect or defend our rights or property; and/or (d) to investigate or assist in preventing any violation of the law.

• CZIF Entities and Affiliates.

  The Chan Zuckerberg Initiative, LLC (“CZI LLC”) is our primary technology partner, focusing on the Site’s infrastructure, security, and compliance. In this role, CZI LLC is a data controller for all data referenced in this Privacy Policy. As with Service Providers mentioned above, CZI LLC‘s use of data is limited by this Privacy Policy. “Affiliates” refers to entities controlled by or under common control with CZIF (such as CZI LLC) and does not include Meta Platforms, Inc. for purposes of this policy.

• Reorganization, Sale or Merger.

  We may disclose your information in connection with a merger, reorganization, or sale of all or a portion of our organization or assets related to CZIF. In the event of a merger, reorganization or sale of assets, the buyer or other successor entity will continue to be bound by the terms of this Privacy Policy.

Choices and Rights

• Delete data.

  You can ask us to erase or delete all or some of your personal data subject to our legal obligations and lawful exceptions.

• Change or correct personal data.

  You can also ask us to change, update, or fix inaccurate data in certain cases, subject to our legal obligations and lawful exceptions.

• Object to, limit, or restrict use of personal data.

  You can ask us to stop using all or some of your personal data (e.g., if we have no legal right to keep using it) or to limit our use of it (e.g., if your personal data is inaccurate or unlawfully held).

• Right to access and/or take your personal data.

  You can ask us for a copy of your personal data in machine-readable form.

• Right to notice.

  You have a right to receive notice of our personal information collection, use, retention, and disclosure practices at or before collection of personal information.

• The right not to be discriminated against.

  CZIF will not discriminate against you in any manner for exercising any of the above rights with respect to your personal data.

If you would like to exercise your right to any of the above, email us at privacy@chanzuckerberg.com. In the email, please provide us with your name, the country (and state if within the United States) in which you live, which of the above rights you would like to exercise, and sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information. If you would like an authorized agent to make a request for you, have that agent email privacy@chanzuckerberg.com with the above information along with additional information sufficient for us to verify that the authorized agent is acting on your behalf. Please also let us know if you have questions or concerns related to exercising any rights you have under applicable law to control your personal data.

If you would like to appeal a CZI decision with respect to a request to exercise any of these rights, please email us at privacy@chanzuckerberg.com and explain the basis for your appeal.

If you wish to raise a concern about our use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority.

Security

Security of personal data is important to us. We implement security safeguards designed to protect your personal data, including reasonable administrative, technical, and physical safeguards to protect that personal data from unauthorized access, use, alteration and destruction. Despite these efforts, we cannot guarantee that your data may not be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or administrative safeguards. Please notify us immediately at security@chanzuckerberg.com if you become aware of any security issues relating to the Site.

Data Transfers

CZIF is based in the United States; when you engage with the Site, you are sending personal data into the United States which may have different data protection rules than those of your country. We process data both inside and outside of the United States.

Our Legal Bases

We will collect, use and disclose your personal data only where we have a legal right to do so. This section explains our legal bases for processing personal data, including under GDPR.

• Consent.

  We rely on consent to engage in certain data collection activities, like data you choose to submit to us for display on CELLxGENE Discover or if you decide to sign up for our newsletter.

• Legitimate Interests.

  We rely on legitimate interests to process the device and log data we collect when you use the Site. We process this data based on our legitimate interest in understanding how the Site is being used so we can improve it and have a sense of its impact, and your legitimate interest in accessing the Site.

• Contract.

  We rely on contract where processing is necessary for the performance of a contract with you (e.g., to make the data you submitted to us publicly available via CELLxGENE Discover).

  Where we rely on consent, you have the right to revoke your consent and where we rely on legitimate interests, you have the right to object by emailing us at privacy@chanzuckerberg.com. If you have any questions about the lawful bases on which we collect and use your personal data, please contact us at GDPR-REP@chanzuckerberg.com.

Additional Information For California Residents

The California Consumer Privacy Act (“CCPA”) requires certain businesses to give California residents a number of rights regarding their personal information. We are offering these rights to you, including the right to have your personal information deleted (subject to certain exceptions), the right to change or correct your personal information, the right to limit the use or disclosure of your sensitive personal information (if applicable), the right to access your personal information, the right to opt-out of the “selling” or “sharing” of personal information (if applicable), and the right not to be discriminated against for exercising these rights.

These rights, and how to exercise them, are described in more detail in the Section titled “Choices and Rights” of this Policy Policy. In addition to these rights, we give you a right to request the following information about your personal information that we have collected in the past 12 months:

• Information about Data Collection

  • The categories of personal information that have been collected about you.
  • The categories of sources from which we have collected personal information.
  • The business purpose for which we have collected personal information.

• Information about Data Disclosure

  • The categories of personal information, if any, that have been sold, shared, or disclosed for a business purpose to third parties.
  • The categories of third parties to whom personal information was sold, shared, or disclosed for a business purpose.
  • Identification of the specific business purpose for disclosing the consumer’s personal information.

We have described in fuller detail in this Privacy Policy the personal information that we collect, how we use, and disclose it, but provide the following additional disclosure:

Information about Data Collection

• Information we collect.

  We have collected the following categories of personal information from consumers within the past 12 months: (1) identifiers; (2) professional or employment-related information; (3) internet or other electronic network activity; (4) geolocation data; and (5) information provided through survey responses or feedback sessions. We have not sold this information nor have we shared this information for behavioral advertising purposes.

• Sources of information.

  We obtain these categories of personal information from the sources described in the Section titled “Data We Collect.”

• Purposes of collection.

  We collect personal information for one or more of the following business purposes as described in the Section titled “How We Use Your Data” above.

Information about Data Disclosure

• Information we disclose.

  We have disclosed the following categories of personal information within the past 12 months: (1) identifiers; (2) professional or employment-related information; (3) internet or other electronic network activity; (4) geolocation data; and (5) information provided through survey responses or feedback sessions. We have not sold this information nor have we shared this information for behavioral advertising purposes.

• Third parties to whom we disclose.

  The categories of third parties to whom we have disclosed this personal information are described in the Section titled “How We Disclose Information” in this Privacy Policy.

• Purposes of disclosure.

  We disclose the personal information we collect about you for one or more of the following business purposes described in the Section titled “How We Use Your Data” above.

• Sensitive data.

  We do not collect sensitive personal information, and thus we do not disclose or use your sensitive information.

Additional Information for Residents of Virginia, Colorado, Connecticut, and Utah

Virginia, Colorado, Connecticut, and Utah also have adopted privacy laws that give consumers certain rights, including the right to confirm whether controllers are processing the consumer’s personal data, the right to access that data, the right to obtain a copy of that data, the right to correct inaccuracies in that data, and the right to delete that data. As discussed above in the Section titled “Choices and Rights,” we provide these rights to all consumers, regardless of where they reside.

Additionally, these four states have adopted rights to opt-out of: (1) targeted advertising; (2) the sale of personal data; and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. We do not sell your data, use it for targeted advertising or to profile you in furtherance of decisions that produce legal or similarly significant effects.

Other Important Information

• Direct Marketing and Do Not Track Signals.

  We don’t currently disclose personal data with third parties for their direct marketing purposes, nor do we support any Do Not Track ("DNT") signals, since there’s currently no standard for how online services respond to those signals. As standards develop, we may establish policies for responding to DNT signals that we would describe in this Privacy Policy.

• Children.

  We do not have actual knowledge that we have sold or shared the personal information of users under 16 years of age.

• Changes.

  We may modify this Privacy Policy from time to time, and you can see when the last update was by looking at the “Last Updated” date at the top of this Policy. If we make material changes to it, we’ll provide you notice through this Privacy Policy. Your continued use of the Site after we publish a notice about changes to this Privacy Policy means that you acknowledge and agree to the updated Privacy Policy following the date it takes effect.

• Contact Information.

  If you have questions or complaints regarding this Privacy Policy, please contact us at privacy@chanzuckerberg.com.
  To comply with article 27 of the GDPR and the UK-GDPR, we have appointed a representative who can accept communications on behalf of CZIF and CZI LLC in relation to personal data processing activities falling within the scope of the GDPR or the UK-GDPR. If you wish to contact them, their details are as follows:
  
  

  European GDPR Representative:
  Bird & Bird GDPR Representative Services SRL
  Avenue Louise 235
  1050 Bruxelles
  Belgium
  EUrepresentative.ChanZuckerberg@twobirds.com

  UK Data Protection Representative:
  Bird & Bird GDPR Representative Services UK
  12 New Fetter Lane
  London EC4A 1JP
  United Kingdom
  UKrepresentative.ChanZuckerberg@twobirds.com